# CVE-2026-44972: DataDog GuardDog terminal escape injection in scan output

Source: https://junglewise.ai/threats/cve-2026-44972-datadog-guarddog-terminal-escape-injection-in-scan-output  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44972 · Severity: medium · CVSS 5 · Published 2026-05-27

GuardDog is a tool used to scan Python packages for malicious content. A vulnerability in its reporting component allows a malicious package to include special hidden characters in its filenames or code. When a security analyst scans such a package, these characters can manipulate the analyst's terminal screen, potentially clearing logs, spoofing scan results, or creating misleading clickable links.

Technologies: [guarddog (PyPI)](https://junglewise.ai/threats/technologies/guarddog). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44972 being exploited in the wild.

**How severe is CVE-2026-44972?** Medium severity, with a CVSS score of 5, published 27 May 2026.

**Which products and versions are affected?** guarddog (PyPI) >= 2.6.0, <= 2.9.0, ECOSYSTEM:introduced=2.6.0,last_affected=2.9.0.

**Is there a fix for CVE-2026-44972?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44972 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44972?** Check whether you run guarddog (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

GuardDog's HumanReadableReporter fails to sanitize or escape ANSI and OSC terminal control sequences (such as \x1b) found in attacker-controlled data. This data includes package filenames, file paths, and source code snippets extracted during the scan process. An attacker can craft a malicious package with filenames or code containing these sequences. When the CLI tool renders the scan results, the terminal interprets these raw bytes, enabling an attacker to clear terminal output, spoof log entries, or emit OSC 8 hyperlinks. The vulnerability exists in guarddog/analyzer/analyzer.py and guarddog/reporters/human_readable.py.

## Affected products

- DataDog guarddog >= 2.6.0, <= 2.9.0

## Identifiers

- CVE-2026-44972
- GHSA-m5p4-gvpx-4mvr
- PYSEC-2026-2506

## Timeline

- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-27: disclosed: NVD publication date

## References

- [https://api.github.com/users/bg0d-glitch](https://api.github.com/users/bg0d-glitch)
- [https://github.com/bg0d-glitch](https://github.com/bg0d-glitch)
- [https://api.github.com/users/bg0d-glitch/gists%7B/gist_id%7D](https://api.github.com/users/bg0d-glitch/gists%7B/gist_id%7D)
- [https://api.github.com/users/bg0d-glitch/repos](https://api.github.com/users/bg0d-glitch/repos)
- [https://avatars.githubusercontent.com/u/147250644?v=4](https://avatars.githubusercontent.com/u/147250644?v=4)
- [https://api.github.com/users/bg0d-glitch/events%7B/privacy%7D](https://api.github.com/users/bg0d-glitch/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1430 - GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE](https://junglewise.ai/threats/cve-2026-22871-guarddog-path-traversal-vulnerability-leads-to-arbitrary-file)
- [PYSEC-2026-1429 - GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS](https://junglewise.ai/threats/cve-2026-22870-guarddog-zip-bomb-vulnerability-in-safe-extract-allows-dos)
- [DataDog GuardDog SSRF and credential disclosure in remote project scanning](https://junglewise.ai/threats/cve-2026-44971-datadog-guarddog-ssrf-and-credential-disclosure-in-remote-project)
- [GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package](https://junglewise.ai/threats/cve-2022-23531-guarddog-vulnerable-to-arbitrary-file-write-when-scanning-a)
- [GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package](https://junglewise.ai/threats/cve-2022-23530-guarddog-vulnerable-to-arbitrary-file-write-when-scanning-a)